×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ranafge
Loves-to-Learn Lots
Member since: ‎04-26-2025
‎05-31-2025
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-26-2025
View All

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
‎04-29-2025 12:04 AM
‎04-29-2025 12:04 AM
Hi @livehybrid, Thanks for your response. Yes it is JSON structured data but there is not data like data -> vulnerability -> severity. How can i send you root cause analysis data? sample data : {"timestamp":"2025-04-29T12:44:53.812+0600","rule":{"level":5,"description":"Systemd: Service exited due to a failure.","id":"40704","firedtimes":4,"mail":false,"groups":["local","systemd"],"gpg13":["4.3"],"gdpr":["IV_35.7.d"]},"agent":{"id":"001","name":"debian-pc","ip":"192.168.11.XX"},"manager":{"name":"ubuntu"},"id":"1745909093.11585380","full_log":"Apr 29 06:44:53 proxmox systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE","predecoder":{"program_name":"systemd","timestamp":"Apr 29 06:44:53","hostname":"proxmox"},"decoder":{"name":"systemd"},"location":"journald"} ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
‎04-28-2025 09:00 PM
‎04-28-2025 09:00 PM
Hi @livehybrid  First of all, thanks for your response. When I search using index="wazuh-alerts", I get lots of events. For the search index="wazuh-alerts" "Medium", I get 7 events. ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
‎04-28-2025 08:28 AM
‎04-28-2025 08:28 AM
Hi @livehybrid  First of all, thanks for your response. When I search using index="wazuh-alerts", I get lots of events. For the search index="wazuh-alerts" "Medium", I get 7 events. ... View more

Re: No Vulnerability Detection Data Appearing in S...

by in Dashboards & Visualizations
‎04-27-2025 02:32 AM
‎04-27-2025 02:32 AM
First of all thanks for your reply. I ran the following search in Splunk: index="wazuh-alerts" "data.vulnerability.severity"="Medium" | stats count I also tested for other severity levels like "High" and "Low," but the result was always 0. This indicates that no vulnerability detection events are being indexed in Splunk. Even though other types of data are coming through, there are currently no events where data.vulnerability.severity is populated with "High," "Medium," or "Low." It suggests that either: Vulnerability Detector is not generating results, The events are not being forwarded to Splunk properly, Or the events are being indexed but under a different sourcetype, index, or field structure. Would appreciate any guidance on how to dig deeper into this! ... View more

No Vulnerability Detection Data Appearing in Splun...

by in Dashboards & Visualizations
‎04-26-2025 08:47 AM
‎04-26-2025 08:47 AM
Hello Splunk Community, I'm seeking help regarding an issue I’m facing. The main problem is that vulnerability detection data is not showing up in my Splunk dashboard. Wazuh is installed and running correctly, and other data appears to be coming through, but the vulnerability detection events are missing. I've verified that: Wazuh services are running properly without critical errors. Vulnerability Detector is enabled in the Wazuh configuration (ossec.conf). Wazuh agents are reporting other types of events successfully. Despite this, no vulnerability data appears in the dashboard. Could someone guide me on how to troubleshoot this? Any advice on checking Wazuh modules, Splunk sourcetypes, indexes, or forwarder configurations would be highly appreciated. Thank you in advance for your support! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-31-2025 07:44 AM